thumbgate 1.34.2 → 1.35.0

package/public/numbers.html

@@ -25,7 +25,7 @@
   "alternateName": "thumbgate",
   "applicationCategory": "DeveloperApplication",
   "operatingSystem": "Cross-platform, Node.js >=18.18.0",
-  "softwareVersion": "1.34.2",
+  "softwareVersion": "1.35.0",
   "url": "https://thumbgate-production.up.railway.app/numbers",
   "dateModified": "2026-08-03",
   "creator": {
@@ -202,7 +202,7 @@
 <main class="container">
   <h1>The Numbers</h1>
   <p class="subtitle">Generated first-party operational snapshot from the ThumbGate runtime. This is not customer traction, install volume, revenue, or proof that a configured gate has fired.</p>
-  <div class="freshness">Updated: 2026-08-03 · Version 1.34.2</div>
+  <div class="freshness">Updated: 2026-08-03 · Version 1.35.0</div>
   <div class="truth-note"><strong>Read this first:</strong> configured checks are inventory. Recorded blocks and warnings are usage evidence. This snapshot currently reports 0 recorded hard-block event(s) and 0 recorded warning event(s).</div>
 
   <h2>Gate enforcement</h2>

package/scripts/auto-promote-gates.js

@@ -206,13 +206,31 @@ function extractExecutableAction(entry) {
   const ctx = String(entry.context || entry.whatWentWrong || '').trim();
   if (ctx.length < 4) return null;
 
+  // Strong signal: known tool prefixes — accept immediately.
+  const known = /^(?:sudo\s+)?(?:kubectl|git|npm|npx|yarn|pnpm|python|python3|node|curl|wget|docker|podman|rm|mv|cp|chmod|chown|psql|mysql|mongo|terraform|pulumi|aws|gcloud|az|helm|ssh|scp|rsync|make|cargo|go|ruby|perl|bash|sh|zsh)\b/i.test(ctx);
+  if (known && ctx.length <= 240) return ctx;
+
+  // Reject agent-narration prose before the weak "looks like a command" heuristic.
+  // "Agent (grok) auto-sent …" was previously accepted because it starts with a
+  // single token + spaces, then became an inert force-gate pattern (AGENT-259).
+  if (/^(?:agent|the|user|ceo|claude|grok|codex|gemini|assistant|operator)\b/i.test(ctx)) {
+    return null;
+  }
+  if (/\b(?:without\s+(?:human\s+)?review|thumbs?-?down|auto-sent|always-approve)\b/i.test(ctx)) {
+    return null;
+  }
+  // Parenthetical asides ("Agent (grok, always-approve)") are prose, not argv.
+  if (/\([^)]{0,40}\b(?:grok|claude|codex|always-approve|agent)\b/i.test(ctx)) {
+    return null;
+  }
+
   // Looks like a shell / CLI invocation (not free-form prose).
   const looksExecutable = /^(?:sudo\s+)?(?:~\/|\.\/|\/)?(?:[A-Za-z0-9._+-]+\/)*[A-Za-z0-9._+-]+(?:\s|$)/.test(ctx)
     && /\s|^[a-z0-9._+-]+(?:\s|$)/i.test(ctx)
-    && !/\s+(?:broke|failed|wrong|should|never|please|the agent)\b/i.test(ctx.slice(0, 80));
-  // Strong signal: known tool prefixes
-  const known = /^(?:sudo\s+)?(?:kubectl|git|npm|npx|yarn|pnpm|python|python3|node|curl|wget|docker|podman|rm|mv|cp|chmod|chown|psql|mysql|mongo|terraform|pulumi|aws|gcloud|az|helm|ssh|scp|rsync|make|cargo|go|ruby|perl|bash|sh|zsh)\b/i.test(ctx);
-  if (known || (looksExecutable && /[\s-]/.test(ctx) && ctx.length <= 200)) {
+    && !/\s+(?:broke|failed|wrong|should|never|please|the agent|auto-sent|emailed)\b/i.test(ctx.slice(0, 100));
+  // Weak path: require a flag or path-like token so "Agent wrote a bad summary" fails.
+  const hasCliShape = /(?:\s-{1,2}[A-Za-z][\w-]*|\/[A-Za-z0-9._-]{2,}|\.(?:js|ts|py|sh|json|yml|yaml)\b)/.test(ctx);
+  if (looksExecutable && hasCliShape && ctx.length <= 200) {
     return ctx;
   }
   return null;
@@ -307,6 +325,64 @@ function contextToPattern(context) {
   return raw.slice(0, 120).replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
 }
 
+/**
+ * Known incident classes that appear as English prose in force-gate / feedback
+ * but map to a deterministic tool-call surface. Without this, force-promote of
+ * "agent emailed X without review" stores the sentence as a regex and never
+ * matches any tool call (AGENT-259, June 2026 + Aug 2026 recurrence).
+ */
+function deriveSurfacePattern(context) {
+  const text = String(context || '');
+  if (!text.trim()) return null;
+
+  const emailish = /\b(gmail|e-?mail|smtp|sendmail|msmtp|mailx|nodemailer|smtplib|messages\/send|send_message|send_draft|send-mail|outbound\s+email|cold\s+outreach)\b/i.test(text);
+  const sendish = /\b(send|sent|sending|emailed|mail(ed)?)\b/i.test(text);
+  if (emailish && sendish) {
+    // Mirrors config/gates/default.json outbound-email-send + the live
+    // ~/.thumbgate/bin/outbound-email-guard.js surface set.
+    return '(?:(?:^|[_.])send[_-]?(?:message|mail|email|now|draft)s?\\b|emailer[_-]?messages?[_-]?send|users\\/[^/\\s"\']+\\/messages\\/send|\\bmessages\\/send\\b|messages\\s*\\(\\s*\\)\\s*\\.\\s*send\\s*\\(|\\bsendmail\\b|\\bmsmtp\\b|\\bsmtplib\\b|\\bnodemailer\\b)';
+  }
+
+  if (/\bforce[- ]?push\b|git\s+push\s+(?:-f|--force)\b/i.test(text)) {
+    return 'git\\s+push\\s+(--force|-f)';
+  }
+
+  if (/\b(rm\s+-rf\s+\/|sudo\s+rm\s+-rf)\b/i.test(text)) {
+    return '(?:sudo\\s+)?rm\\s+-rf\\s+/';
+  }
+
+  return null;
+}
+
+/**
+ * True when a gate pattern is essentially an English sentence — many words,
+ * no executable tokens — and therefore cannot fire against tool-call text.
+ */
+function isInertProsePattern(pattern) {
+  if (!pattern || typeof pattern !== 'string') return true;
+  // Intentional multi-alternative surface matchers (email send, force-push classes).
+  if (/\(\?:/.test(pattern) && pattern.includes('|')) return false;
+  // Unescape common contextToPattern escapes so we can inspect the words.
+  const unescaped = pattern
+    .replace(/\\([.*+?^${}()|[\]\\])/g, '$1')
+    .replace(/\\\\/g, '\\');
+  const words = (unescaped.match(/[A-Za-z]{3,}/g) || []);
+  if (words.length < 6) return false;
+  // Short CLI / known surface tokens only — a long English sentence that merely
+  // *mentions* "gmail" is still inert (it will never equal a tool-call string).
+  const trimmed = unescaped.trim();
+  const looksLikeCli =
+    /^(?:sudo\s+)?(?:kubectl|git|npm|npx|yarn|pnpm|python|python3|node|curl|wget|docker|podman|rm|bash|sh|zsh)\b/i.test(trimmed)
+    && trimmed.length <= 160;
+  const looksLikeSurfaceToken =
+    words.length <= 8
+    && /(?:send_message|send_draft|messages\/send|sendmail|force-push|git\s+push\s+(?:-f|--force))/i.test(trimmed);
+  if (looksLikeCli || looksLikeSurfaceToken) return false;
+  return true;
+}
+
+
+
 /**
  * A gate that cannot match the very context that produced it is inert — it
  * shows up in the dashboard as an active blocking rule while enforcing nothing.
@@ -322,39 +398,51 @@ function gateMatchesOwnContext(gate, context) {
 }
 
 function buildGateRule(group, actionOverride) {
-  const action = actionOverride || (group.count === 'MANUAL' ? group.manualAction || 'block' : (group.count >= BLOCK_THRESHOLD ? 'block' : 'warn'));
+  // Tests and callers may pass partial groups; never crash on missing fields.
+  const g = group && typeof group === 'object' ? group : {};
+  const action = actionOverride || (g.count === 'MANUAL' ? g.manualAction || 'block' : (g.count >= BLOCK_THRESHOLD ? 'block' : 'warn'));
   const severity = action === 'block' ? 'critical' : action === 'approve' ? 'high' : 'medium';
-  const executable = (group.latestExecutable || extractExecutableAction({ context: group.latestContext }) || group.latestContext || '').slice(0, 120);
-  const context = executable;
-  const kind = group.key.startsWith('diagnosis:')
+  const fromExecutable = (g.latestExecutable
+    || extractExecutableAction({ context: g.latestContext })
+    || '').slice(0, 120);
+  // Prefer real executable text; else a derived surface regex (email send, force-push).
+  // NEVER fall back to free-form English prose — that produced permanently inert gates.
+  const surfacePattern = g.surfacePattern || deriveSurfacePattern(g.latestContext || g.key || '');
+  const pattern = fromExecutable
+    ? contextToPattern(fromExecutable)
+    : (surfacePattern || null);
+  const context = (fromExecutable || g.latestContext || g.key || '').slice(0, 120);
+  const kind = String(g.key || '').startsWith('diagnosis:')
     ? 'repeated diagnosis'
-    : group.key.startsWith('constraint:')
+    : String(g.key || '').startsWith('constraint:')
       ? 'repeated constraint violation'
-      : 'repeated executable action';
+      : (fromExecutable ? 'repeated executable action' : 'derived surface guard');
 
-  const occurrencesText = group.count === 'MANUAL' ? 'manual' : `${group.count} occurrences`;
+  const occurrencesText = g.count === 'MANUAL' ? 'manual' : `${g.count == null ? 0 : g.count} occurrences`;
   const suggestedMessage = `Auto-promoted ${kind}: "${context}" (${occurrencesText} in ${WINDOW_DAYS} days)`;
 
   // TTL: auto-promoted rules expire after the configured window unless
   // refreshed by a fresh fire. Manual force-promote bypasses TTL — operator
   // says "permanent" by going through the force path.
   const nowMs = Date.now();
-  const isManual = group.count === 'MANUAL';
+  const isManual = g.count === 'MANUAL';
   const expiresAt = isManual ? null : new Date(nowMs + getRuleTtlMs()).toISOString();
 
   return {
-    id: patternToGateId(group.key),
-    trigger: `auto:${group.key}`,
-    // Derived from the executable action, NOT from tag keys — see contextToPattern.
-    pattern: contextToPattern(executable),
+    id: patternToGateId(String(g.key || 'unknown')),
+    trigger: `auto:${g.key || 'unknown'}`,
+    // Derived from executable action OR known surface class — never raw prose.
+    pattern,
     action,
     message: suggestedMessage,
     severity,
-    occurrences: group.count,
+    // Always numeric — string 'MANUAL' concatenated into gate-stats totals (0MANUAL…).
+    occurrences: g.count === 'MANUAL' ? 1 : Number(g.count) || 0,
     promotedAt: new Date().toISOString(),
     expiresAt,
     lastFiredAt: null,
-    source: group.source || 'auto-promote',
+    source: g.source || 'auto-promote',
+    ...(surfacePattern && !fromExecutable ? { surfaceDerived: true } : {}),
   };
 }
 
@@ -430,21 +518,51 @@ function recordGateFire(data, gateId, now = Date.now()) {
 
 function forcePromote(context, action = 'block') {
   if (!context) throw new Error('context is required for force-promote');
+  let executable = extractExecutableAction({ context });
+  // If extractExecutableAction returned narration that would become inert prose,
+  // drop it and fall through to surface derivation (email send, force-push, …).
+  if (executable && isInertProsePattern(contextToPattern(executable))) {
+    executable = null;
+  }
+  const surfacePattern = deriveSurfacePattern(context);
+  // Prefer a known surface class over a weak "command-shaped" string when both exist
+  // and the command is not a known CLI prefix — prevents dual wrong-pattern promotion.
+  if (executable && surfacePattern && !/^(?:sudo\s+)?(?:kubectl|git|npm|npx|curl|python|python3|node|bash|sh|zsh|rm)\b/i.test(executable)) {
+    executable = null;
+  }
+  if (!executable && !surfacePattern) {
+    throw new Error(
+      'force-promote refused: context is prose without a matchable tool surface. '
+      + 'Pass an executable command (e.g. "git push --force") or describe a known '
+      + 'class (email send / Gmail messages/send, force-push, rm -rf /).',
+    );
+  }
+
   const data = loadAutoGates();
   const gateId = patternToGateId(context);
-  
+
   // Remove existing if any
   data.gates = data.gates.filter(g => g.id !== gateId);
-  
+
   const gate = buildGateRule({
     key: context,
     latestContext: context,
+    latestExecutable: executable || '',
+    surfacePattern: surfacePattern || undefined,
     count: 'MANUAL',
     manualAction: action,
-    source: 'force-promote'
+    source: 'force-promote',
   });
+
+  if (!gate.pattern || isInertProsePattern(gate.pattern)) {
+    throw new Error(
+      'force-promote refused: derived pattern is inert prose and would never fire. '
+      + `pattern=${JSON.stringify(gate.pattern)}`,
+    );
+  }
+
   data.gates.unshift(gate);
-  
+
   if (data.gates.length > MAX_AUTO_GATES) {
     data.gates = data.gates.slice(0, MAX_AUTO_GATES);
   }
@@ -454,12 +572,20 @@ function forcePromote(context, action = 'block') {
     gateId,
     context,
     action,
+    pattern: gate.pattern,
+    surfaceDerived: Boolean(gate.surfaceDerived),
     promotedAt: new Date().toISOString(),
-    source: 'force-promote'
+    source: 'force-promote',
   });
 
   saveAutoGates(data);
-  return { gateId, action, totalGates: data.gates.length };
+  return {
+    gateId,
+    action,
+    pattern: gate.pattern,
+    surfaceDerived: Boolean(gate.surfaceDerived),
+    totalGates: data.gates.length,
+  };
 }
 
 function promote(feedbackLogPath, options) {
@@ -472,10 +598,22 @@ function promote(feedbackLogPath, options) {
   // path rather than carrying a near-stale expiresAt.
   const { data: expiredData, expired } = expireGates(loadAutoGates());
   const data = expiredData;
-  if (expired.length > 0) {
+  // Drop permanently inert prose gates left by older force-promote / promotion bugs.
+  const inertRemoved = [];
+  data.gates = (data.gates || []).filter((g) => {
+    if (g && isInertProsePattern(g.pattern)) {
+      inertRemoved.push(g);
+      return false;
+    }
+    return true;
+  });
+  if (expired.length > 0 || inertRemoved.length > 0) {
     saveAutoGates(data);
   }
-  const promotions = expired.map((e) => ({ type: 'expired', gateId: e.id, expiredAt: e.expiresAt }));
+  const promotions = [
+    ...expired.map((e) => ({ type: 'expired', gateId: e.id, expiredAt: e.expiresAt })),
+    ...inertRemoved.map((e) => ({ type: 'quarantined-inert-prose', gateId: e.id, pattern: e.pattern })),
+  ];
 
   for (const group of Object.values(groups)) {
     if (group.count < WARN_THRESHOLD) continue;
@@ -520,7 +658,9 @@ function promote(feedbackLogPath, options) {
     // Never persist a gate that cannot match the context that produced it. Such a
     // gate renders in the dashboard as an active blocking rule while enforcing
     // nothing, which reads as "the agent learned" when it did not.
-    if (!gateMatchesOwnContext(gate, group.latestContext)) {
+    // Surface-derived patterns (email send, force-push) intentionally do NOT match
+    // the English prose incident text — they match the tool surface instead.
+    if (!gate.surfaceDerived && !gateMatchesOwnContext(gate, group.latestContext)) {
       promotions.push({
         type: 'skipped-unmatchable',
         gateId: gate.id,
@@ -529,6 +669,15 @@ function promote(feedbackLogPath, options) {
       });
       continue;
     }
+    if (!gate.pattern || isInertProsePattern(gate.pattern)) {
+      promotions.push({
+        type: 'skipped-inert-prose',
+        gateId: gate.id,
+        reason: 'pattern is English prose and would never match a tool call',
+        occurrences: group.count,
+      });
+      continue;
+    }
 
     // Self-Harness stage 3: before a feedback rule goes live as a hard block,
     // regression-test it against prior allowed actions. If it would have blocked
@@ -619,6 +768,8 @@ module.exports = {
   patternToGateId,
   buildGateRule,
   contextToPattern,
+  deriveSurfacePattern,
+  isInertProsePattern,
   gateMatchesOwnContext,
   regressionCheck,
   getAuditTrailPath,

package/scripts/cli-progress.js

@@ -0,0 +1,111 @@
+'use strict';
+
+/**
+ * Lightweight CLI progress for long-running commands (dashboard, cfo, north-star).
+ * TTY: spinner on stderr. Non-TTY / THUMBGATE_NO_PROGRESS=1: plain step lines.
+ */
+
+const SPINNER_FRAMES = ['⠋', '⠙', '⠹', '⠸', '⠼', '⠴', '⠦', '⠧', '⠇', '⠏'];
+
+function isProgressEnabled(stream = process.stderr, env = process.env) {
+  if (String(env.THUMBGATE_NO_PROGRESS || '').trim() === '1') return false;
+  if (String(env.CI || '').trim()) return false; // avoid noisy CI logs
+  return Boolean(stream && stream.isTTY);
+}
+
+function createCliProgress(options = {}) {
+  const stream = options.stream || process.stderr;
+  const env = options.env || process.env;
+  const enabled = options.enabled !== undefined
+    ? Boolean(options.enabled)
+    : isProgressEnabled(stream, env);
+
+  let label = '';
+  let frame = 0;
+  let timer = null;
+  let active = false;
+
+  function clearLine() {
+    if (!enabled || !stream.clearLine) return;
+    try {
+      stream.clearLine(0);
+      stream.cursorTo(0);
+    } catch { /* non-TTY fallback */ }
+  }
+
+  function paint() {
+    if (!enabled || !active) return;
+    const glyph = SPINNER_FRAMES[frame % SPINNER_FRAMES.length];
+    frame += 1;
+    clearLine();
+    stream.write(`${glyph} ${label}`);
+  }
+
+  function start(nextLabel) {
+    label = String(nextLabel || 'Working…');
+    active = true;
+    if (!enabled) {
+      stream.write(`[thumbgate] ${label}\n`);
+      return;
+    }
+    paint();
+    if (timer) clearInterval(timer);
+    timer = setInterval(paint, 80);
+    if (typeof timer.unref === 'function') timer.unref();
+  }
+
+  function update(nextLabel) {
+    label = String(nextLabel || label);
+    if (!enabled) {
+      stream.write(`[thumbgate] ${label}\n`);
+      return;
+    }
+    if (!active) {
+      start(label);
+      return;
+    }
+    paint();
+  }
+
+  function stop(finalLabel, { ok = true } = {}) {
+    if (timer) {
+      clearInterval(timer);
+      timer = null;
+    }
+    const text = finalLabel != null ? String(finalLabel) : label;
+    if (!enabled) {
+      if (text) stream.write(`[thumbgate] ${text}\n`);
+      active = false;
+      return;
+    }
+    clearLine();
+    if (text) {
+      const mark = ok ? '✓' : '✗';
+      stream.write(`${mark} ${text}\n`);
+    }
+    active = false;
+  }
+
+  function succeed(finalLabel) {
+    stop(finalLabel, { ok: true });
+  }
+
+  function fail(finalLabel) {
+    stop(finalLabel, { ok: false });
+  }
+
+  return {
+    enabled,
+    start,
+    update,
+    stop,
+    succeed,
+    fail,
+  };
+}
+
+module.exports = {
+  createCliProgress,
+  isProgressEnabled,
+  SPINNER_FRAMES,
+};

package/scripts/dashboard-limits.js

@@ -0,0 +1,27 @@
+'use strict';
+
+/**
+ * Shared helpers for dashboard size / heap failures (prod feedback logs).
+ */
+
+function isDashboardDataLimitError(err) {
+  const message = String(err && err.message ? err.message : err || '');
+  return /string longer than|Cannot create a string|ENOMEM|JavaScript heap|out of memory/i.test(message);
+}
+
+function formatDashboardLimitDetail(err, { phase = 'assembly' } = {}) {
+  const cause = err && err.message ? err.message : 'string/heap limit';
+  if (phase === 'stringify') {
+    return 'Dashboard JSON exceeded the runtime string limit. '
+      + 'Use a bounded feedback window or rotate oversized logs. '
+      + `Cause: ${cause}`;
+  }
+  return 'Feedback/memory logs exceeded the safe in-memory limit for dashboard assembly. '
+    + 'Logs are now tail-capped; if this persists, rotate oversized JSONL under the feedback dir. '
+    + `Cause: ${cause}`;
+}
+
+module.exports = {
+  isDashboardDataLimitError,
+  formatDashboardLimitDetail,
+};

package/scripts/dashboard.js

@@ -97,13 +97,61 @@ function buildUnavailableOrgDashboard(windowHours) {
 // Data readers
 // ---------------------------------------------------------------------------
 
-function readJSONL(filePath) {
+// Prod feedback/memory logs can grow past V8's max string size (~512MB–1GB).
+// Full-file readFileSync/stringify then throws:
+//   "Cannot create a string longer than 0x1fffffe8 characters"
+// Cap dashboard JSONL ingestion to a recent tail so /v1/dashboard stays live.
+const DEFAULT_JSONL_MAX_BYTES = 32 * 1024 * 1024; // 32 MiB tail
+const DEFAULT_JSONL_MAX_ENTRIES = 100_000;
+
+function readTextTail(filePath, maxBytes) {
+  const stats = fs.statSync(filePath);
+  const size = stats.size || 0;
+  if (size <= 0) return { text: '', truncated: false, size: 0 };
+  if (!maxBytes || size <= maxBytes) {
+    return { text: fs.readFileSync(filePath, 'utf-8'), truncated: false, size };
+  }
+  const fd = fs.openSync(filePath, 'r');
+  try {
+    const buffer = Buffer.alloc(maxBytes);
+    fs.readSync(fd, buffer, 0, maxBytes, size - maxBytes);
+    let text = buffer.toString('utf-8');
+    const firstNewline = text.indexOf('\n');
+    if (firstNewline >= 0) text = text.slice(firstNewline + 1);
+    return { text, truncated: true, size };
+  } finally {
+    fs.closeSync(fd);
+  }
+}
+
+function readJSONL(filePath, options = {}) {
   if (!fs.existsSync(filePath)) return [];
-  const raw = fs.readFileSync(filePath, 'utf-8').trim();
-  if (!raw) return [];
-  return raw.split('\n').map((line) => {
-    try { return JSON.parse(line); } catch { return null; }
-  }).filter(Boolean);
+  const maxBytes = Number(options.maxBytes) > 0
+    ? Number(options.maxBytes)
+    : DEFAULT_JSONL_MAX_BYTES;
+  const maxEntries = Number(options.maxEntries) > 0
+    ? Number(options.maxEntries)
+    : DEFAULT_JSONL_MAX_ENTRIES;
+  let text;
+  try {
+    text = readTextTail(filePath, maxBytes).text;
+  } catch (err) {
+    // Never let a single bloated/unreadable log take down the whole dashboard.
+    return [];
+  }
+  if (!text || !text.trim()) return [];
+  const lines = text.split('\n');
+  const start = Math.max(0, lines.length - maxEntries);
+  const entries = [];
+  for (let i = start; i < lines.length; i += 1) {
+    const line = lines[i];
+    if (!line) continue;
+    try {
+      const parsed = JSON.parse(line);
+      if (parsed) entries.push(parsed);
+    } catch { /* skip bad line */ }
+  }
+  return entries;
 }
 
 function readJsonFile(filePath) {
@@ -2089,8 +2137,11 @@ module.exports = {
   computeSecretGuardStats,
   computeObservabilityStats,
   readJSONL,
+  readTextTail,
   readJsonFile,
   collectAllFeedbackEntries,
+  DEFAULT_JSONL_MAX_BYTES,
+  DEFAULT_JSONL_MAX_ENTRIES,
 };
 
 if (require.main === module) {

package/scripts/gate-stats.js

@@ -39,10 +39,10 @@ function calculateStats() {
   // Count total blocks/warns from occurrences in auto-promoted gates
   const totalBlocked = autoGates
     .filter((g) => g.action === 'block')
-    .reduce((sum, g) => sum + (g.occurrences || 0), 0);
+    .reduce((sum, g) => sum + (Number(g.occurrences) || 0), 0);
   const totalWarned = autoGates
     .filter((g) => g.action === 'warn')
-    .reduce((sum, g) => sum + (g.occurrences || 0), 0);
+    .reduce((sum, g) => sum + (Number(g.occurrences) || 0), 0);
 
   // Top blocked gate. A configured block rule with zero occurrences is not a
   // "top blocker"; only recorded block events should appear here.

package/scripts/gates-engine.js

@@ -168,6 +168,9 @@ const UNCONDITIONAL_HARD_FLOOR_GATE_IDS = new Set([
   // applyEnforcementPosture, never demote spend blocks to warn-by-default.
   // Apollo $588 incident class (2026-08).
   'financial-control',
+  // Outbound email: irreversible delivery. Must never demote to warn-by-default
+  // even when THUMBGATE_STRICT_ENFORCEMENT is unset (AGENT-259 / District Cyber 2026-08-04).
+  'outbound-email-send',
   TASK_SCOPE_LEASE_EXPIRED_GATE_ID,
   ...SELF_PROTECT_HARD_FLOOR_GATE_IDS,
 ]);
@@ -188,6 +191,8 @@ const CATASTROPHIC_DECLARATIVE_GATE_IDS = new Set([
   'git-clean-force',
   'rm-rf-home-or-root',
   'financial-control',
+  // Never daily-cap discount agent email send (same class as force-push).
+  'outbound-email-send',
 ]);
 const SELF_PROTECT_CONFIG_TARGET_PATTERN = /(?:^|\/)(?:config\/gates\/|config\/(?:budget|enforcement|mcp-allowlists)\.json$|\.thumbgate\/config\.json$|thumbgate\.json$)/i;
 const SELF_PROTECT_HOOK_TARGET_PATTERN = /(?:^|\/)(?:\.claude\/settings(?:\.local)?\.json|\.codex\/config\.toml|scripts\/hook-[^/]+\.(?:js|sh))$/i;
@@ -2274,8 +2279,52 @@ function checkWhenClause(when, constraints) {
   return true;
 }
 
+
+/**
+ * Surfaces a gate pattern can match against.
+ *
+ * Historically only `toolInput.command|file_path|path` was considered. That
+ * made every MCP / non-Bash tool call invisible to pattern gates — including
+ * Gmail `send_message`, Apollo emailer send, and any auto-promoted rule that
+ * mentioned a tool by name. Those gates rendered as "active" with
+ * lastFiredAt:null forever (AGENT-259).
+ *
+ * Surfaces, in order:
+ *   1. Bash/command text (preserves existing `^` anchor behavior)
+ *   2. bare tool name (MCP tools)
+ *   3. tool name + command
+ *   4. common URL/endpoint/action fields (HTTP-shaped tool inputs)
+ *
+ * Body/content is intentionally excluded to avoid false blocks when an agent
+ * *edits code that mentions* a send endpoint.
+ */
+function buildMatchSurfaces(toolName, toolInput = {}) {
+  const name = String(toolName || '').trim();
+  const command = String(toolInput.command || '').trim();
+  const filePath = String(toolInput.file_path || toolInput.path || '').trim();
+  const surfaces = [];
+  const push = (s) => {
+    const v = String(s || '').trim();
+    if (v && !surfaces.includes(v)) surfaces.push(v);
+  };
+  push(command);
+  push(filePath);
+  push(name);
+  if (name && command) push(`${name} ${command}`);
+  if (name && filePath) push(`${name} ${filePath}`);
+  for (const key of ['url', 'endpoint', 'method', 'action', 'path']) {
+    if (toolInput[key] == null) continue;
+    const v = String(toolInput[key]).slice(0, 400);
+    push(v);
+    if (name) push(`${name} ${v}`);
+  }
+  return surfaces;
+}
+
 function matchGate(gate, toolName, toolInput = {}) {
-  let matchText = toolInput.command || toolInput.file_path || toolInput.path || '';
+  // Primary text for audit/reasoning: prefer command, then tool name (MCP).
+  const matchSurfaces = buildMatchSurfaces(toolName, toolInput);
+  let matchText = matchSurfaces[0] || String(toolName || '');
 
   // Claw/hybrid support: enrich matchText with claw metadata (for EnterpriseClaw/OpenShell/Perplexity hybrid agents)
   const clawCtx = toolInput.clawContext || toolInput._claw || (toolInput.agentId ? {
@@ -2309,6 +2358,7 @@ function matchGate(gate, toolName, toolInput = {}) {
     }
 
     matchText = parts.filter(Boolean).join(' | ');
+    if (!matchSurfaces.includes(matchText)) matchSurfaces.push(matchText);
   }
 
   const affected = extractAffectedFiles(toolName, toolInput);
@@ -2350,9 +2400,12 @@ function matchGate(gate, toolName, toolInput = {}) {
   if (gate.pattern) {
     try {
       const regex = new RegExp(gate.pattern);
-      // Match the original text or its git-canonical form, so `git -C <dir> push --force`
-      // is caught by the same pattern as `git push --force`.
-      if (!patternMatchesCommand(regex, matchText)) {
+      // Match command text, tool name, and light payload surfaces. MCP tools
+      // (e.g. Gmail send_message) have no `command` field — without multi-surface
+      // matching, every pattern gate against them is permanently inert.
+      const surfaces = matchSurfaces.length > 0 ? matchSurfaces : [matchText];
+      const anySurfaceMatch = surfaces.some((surface) => patternMatchesCommand(regex, surface));
+      if (!anySurfaceMatch) {
         return { matched: false, matchText, affectedFiles };
       }
       if (gate.id === 'permission-change-approval' && isSafeLocalCredentialHardeningCommand(toolName, toolInput)) {
@@ -4264,6 +4317,7 @@ module.exports = {
   matchesGate,
   evaluateGates,
   evaluateGatesAsync,
+  buildMatchSurfaces,
   extractAffectedFiles,
   parseGitPathspec,
   canonicalizeGitCommand,